Linux uses Prompt_command to realize audit function

Command audit, using logger method to record information to/TMP, the directory can also be modified by their own

This is according to the user to classify, if it is not convenient also can use time to classify also line

This is only in the root user has the record, if wants all user to have the record, must add to/etc/profile inside

echo "Export prompt_command=" {msg=\$ (History 1 | {read x cmd; echo \ $cmd;}); user=\$ (WhoAmI); echo \$ (date \ "+%y-%m-%d%h:%m:%s\"): \ $user: \ ' pwd\ '/:\ $msg----\$ (who am I); } >>/tmp/\ ' hostname\ '. \ ' whoami\ '. History-timestamp ' ">>/root/.bash_profile

Mkdir-p/var/log/user_record/

echo "Export prompt_command=" {msg=\$ (History 1 | {read x cmd; echo \ $cmd;}); user=\$ (WhoAmI); echo \$ (date \ "+%y-%m-%d%h:%m:%s\"): \ $user: \ ' pwd\ '/:\ $msg----\$ (who am I); } >>/var/log/user_record/\ ' hostname\ '. \ ' whoami\ '. History-timestamp ' ">>/etc/profile

Or

Vim/etc/profileexport history_file=/var/log/history/${logname}/' Date ' +%y-%m-%d_%t '. Log &>/dev/null # Custom log file path and name Export prompt_command= ' {date + ' $ (Who am I-|awk "{print \$1\" \ "\$2\" \ "\$5}") $ (History 1 | {read x cmd; echo "$cmd";}) ";} >> $HISTORY _file ' &>/dev/null

A lot of methods can be based on their own needs to do concrete

Linux uses Prompt_command to realize audit function